Spanning Tree Protocol: Preventing Loops in Switched Networks

Why Redundant Links Are Both Necessary and Dangerous

Connecting switches, discussed earlier in this series, with only a single link between them creates a single point of failure — if that link goes down, connectivity between the switches is lost entirely. Adding a second, redundant link solves this reliability problem, but introduces a serious new one: a Layer 2 Loop.

Why Loops Are Catastrophic at Layer 2

Unlike an IP packet, which includes a Time to Live (TTL) field that eventually expires and discards a looping packet, an Ethernet frame has no such mechanism. Without Spanning Tree Protocol, a broadcast frame entering a looped topology would circulate indefinitely, being duplicated and re-flooded out every switch port repeatedly.

Broadcast storm progression without STP:
1. A broadcast frame enters the loop
2. Switch A floods it out all ports, including
   the redundant link to Switch B
3. Switch B floods it back out all ports,
   including back toward Switch A
4. This repeats exponentially, consuming all
   available bandwidth within seconds

Additional consequence: MAC address table instability,
since the same source MAC address appears to arrive
from multiple different ports almost simultaneously

This condition, called a Broadcast Storm, can render an entire switched network completely unusable within seconds of a loop forming — making loop prevention one of the most critical functions any Layer 2 network must implement.

How Spanning Tree Protocol Solves This

Spanning Tree Protocol (STP) solves the loop problem by logically blocking redundant paths while keeping them physically connected, ready to activate automatically if the primary path fails. STP achieves this by building a loop-free logical tree topology on top of the physical mesh of connections.

Step One: Electing a Root Bridge

Every STP topology begins by electing a single Root Bridge — the reference point every other switch calculates its best path toward.

Root bridge election is based on Bridge ID:
Bridge ID = Priority (default 32768) + MAC Address

The switch with the LOWEST Bridge ID becomes
the root bridge — lower priority wins first,
and MAC address breaks any priority ties

-- Influencing root bridge election by lowering priority
Switch(config)# spanning-tree vlan 10 priority 4096

-- A common shortcut that sets priority automatically
-- to be lower than the current root
Switch(config)# spanning-tree vlan 10 root primary

Deliberately setting the priority on a specific, well-positioned switch is standard practice in production networks, since leaving root bridge election entirely to chance (based only on MAC address) can result in a poorly located or underpowered switch becoming the root, creating suboptimal traffic paths throughout the network.

Step Two: Determining Port Roles

Once the root bridge is established, every other switch determines its Root Port (the single best path back toward the root, based on cumulative path cost) and, for each network segment, a Designated Port (the best path forward from the root for that segment). Any port that is neither a root port nor a designated port becomes a Blocking Port — it remains physically connected but does not forward regular traffic, eliminating the loop.

Path cost is based on link speed:
10 Mbps:   cost 100
100 Mbps:  cost 19
1 Gbps:    cost 4
10 Gbps:   cost 2

A switch chooses its root port by finding the
path to the root bridge with the LOWEST total
cumulative cost across all hops

STP Port States

A port does not immediately jump to forwarding traffic; it progresses through a sequence of states designed to prevent temporary loops during the topology's initial convergence or after a change.

Blocking:    receives BPDUs only, does not forward traffic
             or learn MAC addresses (20 sec max age timer)
Listening:   begins participating in STP calculations,
             still does not forward or learn (15 sec)
Learning:    begins learning MAC addresses, still does
             not forward traffic (15 sec)
Forwarding:  fully operational, forwards traffic normally

Total convergence time in classic 802.1D STP:
up to 50 seconds — a significant real-world delay

This slow convergence time was a major practical limitation of original STP, directly motivating the faster Rapid Spanning Tree Protocol (RSTP, 802.1w) used almost universally in modern networks, which achieves convergence in seconds rather than tens of seconds through a fundamentally revised state machine and proactive negotiation between switches.

Verifying Spanning Tree Operation

Switch# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    4096
             Address     0050.56aa.1111
             This bridge is the root

  Bridge ID  Priority    4096
             Address     0050.56aa.1111

Interface     Role  Sts  Cost   Prio.Nbr  Type
Gi1/0/1       Desg  FWD  4      128.1     P2p
Gi1/0/2       Root  FWD  4      128.2     P2p
Gi1/0/3       Altn  BLK  4      128.3     P2p

This output directly confirms the concepts covered above: it identifies the root bridge, shows this switch's own priority, and lists each port's role (Root, Desg for designated, or Altn for alternate/blocking) and current state — the single most important command for diagnosing any suspected Layer 2 loop or unexpected topology behavior.

Why Understanding STP Is Essential, Not Optional

Spanning Tree runs automatically by default on Cisco switches, and many administrators never explicitly configure it — but understanding exactly how root bridge election, port roles, and port states work is essential for two critical reasons: correctly designing redundant topologies that fail over predictably, and rapidly diagnosing the intermittent, hard-to-reproduce connectivity problems that occur when STP behaves unexpectedly, such as after a misconfigured or malfunctioning switch is introduced into an otherwise stable topology.